> Common patterns—like password strength indicators—usually exist for good reasons.
NIST does not recommend password strength indicators. Make sure the form is compatible with password managers.
NIST does not recommend password strength indicators. Make sure the form is compatible with password managers.
> Verifiers SHALL offer guidance to the subscriber to assist the user in choosing a strong password
But I get that "strength" is a poor metric. It shouldn't allow "weak" passwords. It should be binary - pass or fail.
The nicest thing about strength indicators - and I reckon this is why they are copied a lot - is that they are usually real-time feedback to the user with a nice red/orange/green invalid/weak/strong indicator that updates as the user types. The best ones even go as far as show you the list of rules your password is failing to meet, again updating as you type. Much much nicer than the server-side validation form submission loop imo.
So, remove the middle concept of "weak but allowed" passwords from the strength indicator widget, I think then you get good UX that meets NIST recommendations..?
The number of sites that go out of their way to prevent password managers, well any "paste" mechanisms, is still annoying but are becoming fewer.